Suggetion for better explanation for smb_virii.nasl

We've had a few False Positives with smb_virii.nasl claming to have found
viruses (via Registry key matches) - when there is no virus on that box.

However, those boxes *had* either been infected at some stage, or (most
likely) a virus had attempted to infect them, and added Registry keys first
before writing the payload - and their AV had blocked that write (but
ignored the Registry change).

So unless smb_virii.nasl can attempt to see if the file being referenced by
these Registry keys actually exists (could be done...), I'd suggest that the
fact that these "hole" could be FPs should be pointed out explicitly.

Perhaps something like:

 if(exp == NULL || tolower(exp) >< tolower(value))
  {
    report = string(
    "A registry key has been found that implies the virus '", name, \
    "' may present on the remote host\n",
    "Solution : ", url, "\n",
    "Risk factor : High");
    
    security_hole(port:kb_smb_transport(), data:report);
   }
       

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus